
GitHub has updated its SCIM API to include the standard profileUrl attribute in user responses from both organization and enterprise endpoints. This addition, defined by RFC 7643, allows identity providers to directly retrieve the absolute URL of a GitHub account linked to an external identity without requiring additional inference or lookups. The change is additive and does not impact existing integrations, as userName and other attributes remain unchanged. Teams can now read profileUrl when present to streamline user provisioning workflows.
Read original
© GitHub ChangelogGitHub Enterprise Cloud finally addresses the friction of manual SSO authorization for classic tokens and SSH keys. Admins can now delegate bulk authorization to GitHub Apps via a new API, handling up to 50 organizations in one request without exposing secrets. This shift from manual per-org clicks to automated delegation reduces the temptation to use insecure long-lived tokens. It is a practical infrastructure improvement that streamlines credential rotation for large enterprises managing complex access controls.
© GitHub ChangelogGitHub finally closes the friction gap in its usage-based billing model. Instead of hitting a hard wall when credits run out, members can now request more budget directly from their settings, with approvals routing automatically to the correct organizational or enterprise billing manager. This removes the administrative bottleneck that previously stalled productivity, allowing teams to scale AI adoption without constant manual intervention. It is a pragmatic fix for enterprise governance rather than a technological breakthrough.
© GitHub ChangelogGitHub is removing a major friction point for AI-powered security scanning by decoupling AI Scan from the mandatory CodeQL default setup. Previously, organizations had to configure complex CodeQL workflows just to access basic vulnerability detection in pull requests; now, any Advanced Security customer can enable AI Scan directly on eligible repositories without that prerequisite. This shift significantly lowers the barrier to entry for automated code review, allowing teams to adopt AI-driven security checks with minimal configuration overhead. It marks a move toward simpler, more accessible developer tooling within GitHub's enterprise suite.
This release targets the friction points that make local AI coding feel fragile. The most critical fix addresses MCP servers timing out after five minutes regardless of configuration, a major blocker for complex agent workflows. Session reliability also improves with self-healing corrupted transcripts and better handling of background agents during resumption. While not feature-heavy, these patches stabilize the environment for developers relying on long-running automated tasks.
This release patches a critical remote code execution vulnerability in the llama.cpp server that allowed unauthenticated attackers to hijack memory via dangling pointers. The flaw stemmed from caching compute graphs that referenced freed buffers, enabling heap corruption and arbitrary code execution through subsequent tensor commands. By discarding cached graphs when buffers are freed, the fix forces a safe fallback to full recomputation without changing the API. This is a vital security update for anyone running the llama.cpp server remotely, closing a direct path to system compromise.
A copy-paste error in llama.cpp was corrupting matrix transpositions on Spacemit hardware, causing significant data corruption for int16 operations. This release patches the specific RVV instruction call to ensure correct computation on these RISC-V based chips. While niche, it prevents silent inference failures for users relying on this specific accelerator architecture. The update also ships binaries for CUDA 13 and ROCm 10.0, keeping the runtime current with latest driver ecosystems.